Agent Technology for Network Management. Stuart Wagner Sudha Ramesh

Transcription

1 Agent Technology for Network Management Stuart Wagner Sudha Ramesh Keith Landgraf October 10, 2002 An SAIC Company

2 Outline Some mobile agent basics Motivation for their use in network management Specific examples of what mobile agents may be able to do for us Key research issues: major questions and challenges in implementing agent-based network management SSW - 10/10/02 2

3 What is a Mobile Agent (MA)? A Loose, Operational Definition A software object that can be dynamically replicated, dispatched to and retracted from network elements not hard-coded into network-element software Its goals are established by the agent management system; it makes decisions and takes actions autonomously in pursuit of these goals can obtain its own thread of control on host network element The attributes of the agent and the agent management system vary with the application SSW - 10/10/02 3

4 Mobile Agent Illustration Traditional Network Management System Agent Creation and Management System A data base Adaptors A SSW - 10/10/02 4

5 Prior Research: MAs for Network Management Many papers, some dating back >10 years Papers have offered much conjecture on the benefits of MAs for network management, principally: reduction in data traffic related to network management better scalability resulting from a more-distributed network management paradigm The claims are unsubstantiated and remain dubious The REAL value may be in providing carriers with greater flexibility in network-management capabilities filling gaps in conventional management functionality facilitating speedy support of new services and features SSW - 10/10/02 5

6 Our Research Goals Demonstrate MA-based network management functionality in a testbed environment Develop a detailed understanding of what it takes to implement a MA infrastructure Assess the relative value of the mobile-agent approach compared with conventional methods Compare the gain with the pain of an MA-based system Draw conclusions on whether, how and where carriers are likely to use MAs Difficult to do in general terms; use specific network examples and case studies to gain insights SSW - 10/10/02 6

7 Network Example - Metro Ethernet Multi-tenant Building LAN 1 LAN 2 LAN n ISP Point of Presence GbE L2 Switch Web Hoster Access Ring Metro/Regional Network (GbE/10GbE Core) Access Ring Data Storage Facility GW VoIP Gateway SSW - 10/10/02 7

8 Why Focus on Ethernet? The low cost and IP-friendly nature of Ethernet hardware make it attractive to carriers Major Government agencies are planning large-scale Ethernet deployments Pacific Rim countries buying thousands of Ethernet switches for Metro-area applications Domestic carriers have issued requirements for Metro Ethernet networks (both hardware and network management) ISPs increasingly peering with each other at Layer 2 However, managing large-scale Ethernet networks is an unsolved problem and presents many challenges SSW - 10/10/02 8

9 Metro Ethernet Management Challenges Ethernet s roots are in enterprise networks carrier-grade network management capabilities are lacking hardware continues to evolve to meet carriers needs Ethernet switch configuration (e.g., via CLI) is laborintensive, slow and error-prone Ethernet is connectionless carrier cannot directly control traffic routes, similar to conventional IP networks without MPLS Ethernet s reaction to network faults can be unpredictable Ethernet hardware is economical, but inadequate NM capabilities have impeded large-scale carrier deployment SSW - 10/10/02 9

10 Example MA Applications in Metro Ethernet Auto-Discovery Agent Creation and Management System A Notify network management of changes to switch configuration... Discover and report all spanning tree routes... Discover and report all VLAN topologies... SSW - 10/10/02 10

11 Example MA Applications in Metro Ethernet VLAN Configuration Agent Creation and Management System A Configure a VLAN with the following ingress/egress points and QoS parameters... Create a spanning tree for this VLAN with the following route... SSW - 10/10/02 11

12 Example MA Applications in Metro Ethernet Service Validation and SLA Management Agent Creation and Management System A Verify the following configuration settings along the path of VLAN XYZ, and report discrepancies Collect and report jitter and packet-loss statistics on VLAN XYZ SSW - 10/10/02 12

13 Example Platform: Anchor Toolkit/Akenti Lawrence Berkeley Labs POLICY IDENTITY ATTRIBUTES Anchor Server A SSL Anchor Server A Agent Security Manager Akenti Policy Engine Access Validation Interceptor JVM Host 1 LOCAL RESOURCES JVM Host 2 SSW - 10/10/02 13

14 Example Platform: Jini Sun Microsystems Agent Creation and Management System Service Provider Service Object Lookup Service Service Object RMI Service Object Client Managed Network Element SSW - 10/10/02 14

15 Other Agent Systems A Sampling Commercial Aglets from IBM AgentBuilder from IntelliOne Technologies GrassHopper from IKV++ Technologies Academic & Research D Agents from Dartmouth University Mobile Code Toolkit from Carleton University Hive from MIT JATLite from Stanford University JADE from CSELT, Italy FarGo from Isreal Institute of Technology Ajanta from Univ. of Minnesota MAgNET from UCSB SSW - 10/10/02 15

16 Key Questions to Address Will network elements accommodate MAs easily? code loading, Java Virtual Machines (JVMs) How does one maintain control over MA actions? limiting authority and access to network-element resources authentication of MAs How many MAs are needed in a network? should they replicate themselves, or should we use a centralized create, dispatch and retrieve model? How mobile do the MAs have to be? single-hop vs. multi-hop/roaming capability Do MAs need to communicate with one another? How intelligent can/should we make the MAs? SSW - 10/10/02 16

17 Accommodating MAs Direct Support on Switch A Switch Hardware Agent Receptor Access Control JVM Adapter Operating System MIB MIB = Management Information Base SSW - 10/10/02 17

18 Accommodating MAs Use of External Receptor A Access Control JVM Adapter Switch Hardware CLI commands Operating System MIB SSW - 10/10/02 18

19 Security Little work done on security of MA systems Important issues are: Protect Host from an Agent Authenticate an incoming agent Verify security of the information it carries With active agents, agent is probably running before you can authenticate. How do we deal with this? Protect Agent from the Host How can the agent trust the host? No easy solutions for this Protect agents from one another This is very difficult Limit and eventually terminate the agent s power to act on behalf of the network management system SSW - 10/10/02 19

20 Security - continued Most proposals use Java security apparatus Addresses only the rogue agent problem Authenticate the agent Limit its access to protected local resources Does not solve other problems Some (Anchor/Akenti) enhance security provided by Java, principally: Enforce security policies by using interceptors which override Java default mechanisms Use secure encrypted communication between agent servers SSW - 10/10/02 20

21 Number, Mobility and Intelligence of MAs Example Task: Discover the topology of VLAN XYZ Two extreme cases: 1. a single MA hops around the network looking for XYZ 2. separate MAs are dispatched to each machine to look for XYZ; information sent to centralized management system Case (1) requires a more-sophisticated agent that makes mobility decisions and carries its own data Case (2) requires only single-hop mobility and minimal agent intelligence agents act as relatively simple probes while a highly shared management system does the processing Jini-like model; minimizes demand on switch CPU SSW - 10/10/02 21

22 Inter-Agent Communication Three Options Agent Creation and Management System A A 1. Agents communicate directly with each other 2. Agents communicate indirectly, through mail boxes or a proxy server 3. Agents communicate only with management system SSW - 10/10/02 22

23 Observations One can envision many feasible combinations of MA attributes the best combination may depend on the network management task to be performed Developing appropriate metrics may be one of the biggest challenges how do we compare the relative merits of different MA implementations? how do we know if the MA approach is better than conventional network management techniques? can we develop metrics that accurately reflect what really matters to the network operator (e.g., complexity, cost)? SSW - 10/10/02 23